We're using chef for servers. I think it can works for workstations as well. But I'm not sure about disk encryption - is it possible to set it up within running OS.